The flaw resides in aider_mcp.py, where an attacker can manipulate the working_dir/editable_files argument to inject arbitrary shell commands. If successfully exploited, the attacker gains full control over the host, compromising confidentiality, integrity, and availability. The weakness is reflected in CWE-74 and CWE-77, indicating improper input handling and command execution without sanitization.

Vendors and products affected are eiliyaabedini’s aider-mcp, specifically the code_with_ai component. The vulnerability exists in all builds up to the commit 667b914301aada695aab0e46d1fb3a7d5e32c8af; because the project follows a rolling release model, precise version numbers for the patched release are not yet published.

The CVSS score of 6.9 marks this as a medium‑severity issue. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Despite the uncertainty about exploitation probability, the attack vector is likely remote, as the injection can be triggered by an external actor sending a crafted request. The publicly disclosed exploit suggests that the problem is both real and potentially actionable by malicious actors.